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determined events and can report on the applications 
used and communication functions engaged in by the 
user. The log files (11) from one or more computers 
; may be assembled and analyzed in order to ascertain 
computer use habits for computer software, computer 
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1 

Computer Use Mete r smA A nalyzer 

Background of the Invention 

1. Field of the Invention 

The invention relates to a system for monitoring computer use and, 
5 more particularly, a system for collecting, logging, and analyzing 
preselected operations in a personal computer and reporting use trends. 

2. Description of the Related Technology 

The popularity of personal computers has exploded in the past 
decade. Each year more and more people have used more and more 

10 personal computers in more and more ways. This rapid expansion has 
resulted in an astronomical increase in the amount of money spent on 
computers, computer related services, computer software, computer 
peripherals and electronic information and information services. In just 
the past few years, on-line services such as CompuServe, Prodigy, and 

15 America On-Line have gone from virtual obscurity to household words. 
Our children learn to surf the "net" before they can ride bicycles. 
Heretofore, there has been no effective reliable mechanism to measure 
computer usage on a local or broad basis. 

Organizations which sell any computer related products or services 

20 or which conduct any marketing activity in any electronic format will have 
an intense need to measure use of computer related resources and 
dissemination of electronic information. In much the same fashion that 
television advertisers rely on television ratings and viewer demographics 
to evaluate television marketing, "electronic" advertisers and sellers and 

25 producers of computer related products and services will need to evaluate 
information on computer use and "on-line ratings." 
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Summary nf the Tny»nttr™ 

It is an object of the invention to facilitate the collection of reliable 
information regarding the use of personal computer software. 

It is a further object of the invention to facilitate the collection of 
5 reliable multi-media viewing statistics of commercial on-line services as 
well as access to the "information superhighway," including the use of the 
Internet's World Wide Web. 

It is a further object of the invention to facilitate the establishment 
of a panel of personal computer using households in order to develop 

10 useful reports for a number of different industries including, without 
limitation, software manufacturers, commercial on-line service providers 
computer hardware manufacturers, and on-line marketers. 

According to the invention, a system may be provided to intercept 

^ and monitor operating system messages. Such messages may be targeted 

15 instructions to various applications or operating system overhead 
messages. Such messages may be generated internally by the operating 
system software, such as the Microsoft Windows operating environment 
A system according to the invention may filter through a vast array of 
messages and capture only specific messages, such as those messages 

20 which indicate a change in focus from one application to another. These 
changes in focus may include but are not limited to an application launch, 
the termination of an application, switching resources from one 
apphcation to another, minimizing an application, or restoring an 
application. 

25 According to the invention, operating system messages may be 

intercepted and relevant messages may be recorded in a log file, along 
with other pertinent or useful information. Such pertinent or'useful 
information may include date stamps, time stamps, message types such as 
launch, tenninate, switch, niiiiimize, restore, etc., household ID numbers 

30 identification of individual users within a household, identification of an" 
application's executable program file name and file size, an application's 
Window title, and the handle to the "instance" of the apphcation. A 
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household identification number may be a number which uniquely 
identifies a personal computer within a "panel" of households, each of 
which is contributing data to the system through use of a local metering 
system. 

5 Advantageously, the system according to the invention may be 

utilized in association with a plurality of computers and computer users. 
The computers and computer users associated with the system may be 
intended to be representative of a much larger universe of users. This is 
analogous to collection of television viewing information used to establish 

10 television ratings based on a limited number of households. The limited 
number of households is considered representative of the overall computer 
use or "viewing." 

According to the invention, a meter application installed in a 
personal computer may log events for top-level Windows for any given 

15 application. Events which are specific to child Windows of an application 
may not necessarily be logged. For certain applications, additional 
detailed event logging for such child Windows will occur. If an application 
is targeted for more detailed logging, the messages indicating the creation 
of child Windows will be logged. The entries into the log file will 

20 advantageously include at least date, time, household ID number, 
individual within the household using the computer, the handle to the 
instance of the parent application, the parent application's current 
Window title, and the child Windows title. 

In addition, it is an object of the invention to monitor and log 

25 certain external communications. The local meter application will monitor 
strings of characters sent to a communication port such as a modem. The 
system may be set to monitor for certain predetermined character strings 
and log certain information upon occurrence of such strings. If, for 
example, the system detects a "http:" string, then the system will recognize 

30 that what follows should be the remainder of a Universal Resource 
Locator (URL) for a hypertext protocol site on the Internet's World Wide 
Web. If the local meter application identifies a URL, it will intercept and 
log the full URL. In this situation, the log entry may include at least the 
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10 



15 



20 



25 



30 



date, time, household ID number, individual user within the household, 
the handle to the instance of the parent application, the parent 
application's current Window title, and the Universal Resource Locator 
(URL). 

According to the invention, the application may also generate 
specialized logs or log specialized events. These specialized logs/events 
may focus on preselected applications or a class of applications, such as 
on-line services or internet browser requests. Advantageously, a timer 
may be utilized to trigger a periodic audit of the focus of a personal 
computer. The periodic audit may be conducted, for example, every half- 
second or at such other intervals as may be appropriate. The interval may 
be longer to conserve processing resources at the expense of risking 
missing a shift in focus. 

According to one feature of the invention, the periodic audit may 
poll the operating system for all open windows in order to determine if 
preselected applications are ranning. Such preselected applications may 
include on-line service applications, such as America Online, Prodigy, the 
Microsoft Network or Compuserve. If such an application is running! the 
meter application may log the textual content of the title bars of the 
application and the top window in such application. Advantageously the 
system may log the title bar only if the textual contents of the title bars 
of the application or the top window have changed since the previous 
audit. In addition, each audit may monitor open windows for edit boxes 
Upon discovering an edit box in an open window, the system may examine 
the syntax of the content of the edit box in order to determine if it is 
consistent with a URL. If so, the URL may be logged in the event log or 
a specialized log. 

According to the invention, the meter application may have a 
number of other 'housekeeping" features, including a mechanism for 
installing the meter application on the computer, a data compression and 
encryption system for the data log, a log transfer mechanism, a self 
updating software feature, and a user. 
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The data compression and encryption system may advantageously 
be provided to minimize the memory resources which must be allocated 
to storage of the event log and may encrypt the event log in order to 
enhance the security of the information contained therein. 
5 The data transfer system can be provided to transfer the local 

personal computer-use log to a central processing system. The central 
processing system may assimilate many local personal computer use logs, 
translate the log information into useful information, evaluate the 
information, and create various reports and analyses of computer use. 
10 The transfer may be accomplished by any of a number of different 
mechanisms including automated, user initiated, or central office initiated 
electronic transfers, or local downloading to a magnetic storage medium 
such as a diskette, and delivery of the diskette to the central processing 
location. 

15 The computer use meter and its supporting software may from time 

to time undergo system updates. These updates are intended to add 
features to the software and to correct any system bugs. Each, panelist 
will be contacted on a fixed cycle, advantageously once per month, for the 
purpose of collecting the prior month's logged activity. This process may 

20 occur via a diskette mailed to the panelist, or telecommunicated via 
modem. The data transfer program, delivered on whatever medium, may 
first check for any outstanding software upgrades. If one is scheduled, 
then software will automatically be transferred to the panelist's computer. 
The system may include a questionnaire which is invoked in certain 

25 circumstances, such as after use of a particular class of software, type of 
application, or periodically the user may be prompted to input desired 
information which may be stored in the event log or in a separate file. 
The data transfer system may be used to upload the responses and 
download additional questions or triggers. 

30 One of the advantages of the system according to the invention is 

the recordation of changes in processor focus in the event log. Software 
marketers have a pressing need for information about how users behave 
with their products. "Use" information is typically gathered, if at all, 
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through paper questionnaires or telephone interviewing. In such 
situations, the respondent is asked to recall their own uses of the product 
in question. This technique exhibits significant flaws, including the 
limitations and inaccuracies inherent in human recollection, the 
limitations on the amount of time the individual computer user may be 
willing to spend to provide such information, and that the individual 
responding to the questionnaire may be only one of the members of the 
household using the computer system and may not have all of the 
pertinent information. 

The system according to the invention overcomes the 
aforementioned deficiencies. After an initial installation process, the 
system may be completely passive. That is, the computer user does not 
have to take any additional action for the system to operate effectively. 
The use of any software product or application program may automatically 
15 triggerajxeventmessageintheoperatingsystem environment which may 
be recorded by the system. Far more information may be gathered in this 
automated fashion by the computer than by subsequent interaction, with 
a computer user. For example, information relating to the date and time 
of an event may easily be captured using the computer's internal clock 
20 and calendar, where such information would not normally be recalled by 
a user during a subsequent personal report. The construction of the event 
log is typically extremely rich in useful information and will enable 
classification of software usage at least by software title, classification of 
software subcategory (e.g., spreadsheets, screen savers, communications 
25 software, Personal Information Managers, word processors, etc, or by 
household demographics, e.g., presence of children, income, geography, etc. 
The system according to the invention will also be able to measure 
software use by total minutes of use, i.e., cumulative focus minutes, 
frequency of use, i.e., number of accesses in a given time frame, and shari 
of computer use. 

According to an additional advantageous feature, the system will 
enable detailed logging for certain applications. The commercial on-line 
service industry is highly competitive, and with Microsoft entering the 
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industry the competition will be increasing. Currently, the three largest 
providers, CompuServe, Prodigy and America On-Line, each have roughly 
two million subscribers. The single biggest challenge for these 
organizations is to reduce subscriber attrition and increase the length of 
5 time any individual maintains a subscription. Attrition is in effect a 
measure of customer satisfaction and inversely related to an on-line 
service's revenue stream. Reducing attrition means keeping subscribers 
longer and increasing revenue. 

The system according to the invention may advantageously collect 

10 child Window information for commercial on-line service providers and 
user applications. Window titles of these applications' child Windows 
generally hold useful descriptions of the activity at that moment. For 
example, if a subscriber is using the mail syBtem for that service, then the 
Window title will so indicate. The system according to the invention will 

15 record those titles in the log file. 

To illustrate, the Window title for the window for writing an 
electronic mail message is "Create Mail" in CompuServe, "Write" in 
Prodigy, and "Compose Mail" in America On-Line. The collection and 
analysis of this information is valuable for on-line service providers in 

20 many ways which include, but are not limited t o f distribution of tim e 
spent in various features on ftnTnppf.it.iyf. p ff ry jces. identification of whic h 
f eatures of each are preferred by users of multiple services , and 
identification of which features of various services are popular and how 
attention to these features changes relative to the length of subscription 

25 membership. The information recorded in the log is valuable for on-line 
service providers because it can give them direct feedback about customers 
and point out areas for improvement of the services. The system 
according to the invention can also measure traffic within an on-lin e 
c ontent ar aa of a mm m err.jp 1 on-line service, s uch as electronic magazines 

30 and newspapers. As publishers move to on-line media, media traffic 
statistics become critical. It provides a media planner with important 
input. In addition, an advantageous feature of the invention provides for 
interception and logging of communication port or modem traffic. As an 
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extension of tracking activities on commercial on-line services, the system 
according to the invention may create a full picture of on-line activity if 
it also measures traffic on other communication channels such as the 
Internet World Wide Web. Internet sites on the web are addressable by 
5 a Universal Resource Locator scheme. 

On-line marketers are trying to understand the characteristics of 
Web traffic and how much time users spend at different sites. These 
traffic statistics become fundamental inputs for media planning, in a 
fashion analogous to using TV ratings as a basis for buying or pricing 
10 commercial time. 

According to an additional advantageous feature, the system 
includes automated file management functions. These functions are 
needed to keep the system from interfering with the efficient operation of 
the host computer. Event log files can grow quite large. Keeping the log 
as small as possible may be important. Data compression techniques may 
be utilized to reduce the size of the event log. In addition, the system 
according to the invention must maintain as passive a profile as possible. 
Thus, the automated installation and data transfer programs will reduce 
the interference with the use of the computer by the user and ininimize 
the impact on any particular user. 



15 



20 



Brief DeBcriptjnn of the Th-py/fo g^ 

Figure 1 shows a flow diagram for the invention. 
Figure 2 shows an embodiment of the invention. 
Figure 3 shows transmission of messages and events. 
25 Figure 4 shows responses to messages. 

Figure 5 shows an audit-based subsystem. 
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Detailed Description of the Preferred Embodiments 



According to an embodiment of the invention, a system is provided 
to collect, process and deliver information regarding use of personal 
computer resources. Figure 1 illustrates a flow diagram of an embodiment 
5 according to the invention. A computer use meter 1 may be installed on 
a .personal computer owned and/or oper ated by « jumtAitfi, or grou p of 
usersj .0. The panelist advantageously would designate the members of 
a particular household and may constitute one or more individuals. The 
computer use meter advantageously generates an event log file 11. A 

10 mechanism 2 is provided to transmit the event log files to a central 
processing station. The transmission may be accomplished by transfer to 
a portable medium such as a floppy disk or over a communication channel 
such as a telephone link or by electronic mail. The transmission may be 
or triggered by any predetermined criteria such as time, number of logged 

15 events, size of log file, resources used or available or any combination 
thereof. The central processing station accumulates log files from a 
plurality of separate computer use meters 12. The central processing 
station at location 3 will load a data base 13 with the information from 
the plurality of event log files. The central processing station may be a 

20 micro processor based computer and may utilize a variety of commercially 
available and/or custom developed data base management systems 4 to 
manage the computer use data base 13 and create a customized data 
dictionary 14. The customized data dictionary is provided to interpret the 
raw data provided by the event log files. In addition, the data base 

25 management system 4 may extract useful information, provide preuminary 
processing and/or analysis of the accumulated event log files. The system 
will also identify usage data at location 15. Any logged event which is not 
recognized by the customized dictionary will be noted as an exception and 
stored for subsequent manual identification. User or manual intervention 

30 at this stage may enable further identification and the customized 
dictionary 14 may be updated so that subsequent occurrences of a similar 
event will be automatically identified by the customized dictionary 14. All 
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log events identified either through the customized dictionary or through 
manual intervention 15 will be utilized to create a raw data base of 
information at location 5. This data base may be organized by different 
database management systems. It is contemplated that the data base may 
5 be in the form of a NPD/POWERVIEW data base 16, commercially 
available from The'NPD Group, Inc. 

At location 6, the Powerview data base management system may 
generate reports or preprocess information in the data base for subsequent 
analysis 7. The system may generate reports showing information derived 

10 from the data base elements maintained. The data may be organized and 
reported in virtually any desired formula and organization. Given the 
strengths and weaknesses of various commercially available data base 
management systems, the data may be processed through one or more 
data base management systems to generate hard copy reports 17 or to 

15 generate a sub-database which may utilized for ad hoc analysis or report 
generation 18. 

Figure 2 shows a computer use meter according to the invention 
with a representation of information and data flow installed in an IBM- 
compatible personal computer operating in the Windows environment. 

20 The Windows environment internally generates messages used by various 
modules to manage the operation of the computer and allocate its 
resources. Most application program development does not require 
treatment with the internal overhead handled by the operating system. 
The Windows environment handles a vast array of overhead functions 

25 through the use of internal drivers. The internal drivers may include a 
Windows keyboard driver 20 and a Windows mouse drive 21. These 
drivers manage the overhead of manipulating mouse pointers, clicking the 
mouse buttons and entering information on the keyboard. User interface 
events such as mouse events and keyboard events are transmitted to a 

30 Windows user module 22. 

As shown in figure 2, the main operating module 23 of the 
computer use meter is identified as RITA and operates within its own 
window. The Windows user module 22 generates appUcation-specific 
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messages such as WM_CREATE, WM_SYSCOMMAND, WM_COMMAND, 
WM_QUERYENDSESSION, and WM DESTROY. These messages are 
intended only for specific main window application modules. RITA 
module 23 monitors these messages for commands invoking the RITA 
5 application main window 23. After being invoked, the HOOKS DLL 
module 24 operates to provide messages to the RITA i mpi" window module 
23. During operation of the personal computer, the Windows user module 
22 generates Windows call-back or "CBT" events. Certain specific events 
are intercepted by the HOOKS DLL module and transmitted to the RITA 

10 •main module 23. Upon receipt of such m ess ages, the RITA main window 
sends certain messages to the RITA logging subsystem 24. In addition, 
the RITA main window 23 transmits program run time parameters to the 
RITA INI file subsystem 25. The RITA INI file subsystem will 
communicate with a panelist information dialogue box 26 for the purposes 

15 of panelist name collection. The panelist information dialogue box 26 will 
also transmit an active user name to the RITA main window 23. The 
active user name is utilized in connection with the logging operation. 

Figure 3 illustrates transmission of Windows CBT events and 
Windows user defined messages. Upon the Windows user module 22 

20 generating an HCBT_ACTIVATE message, such message is recognized 
and registered by the HOOKS DLL module. The HCBT_ACTIVATE 
indicates identification of the currently active window and the window 
about to be activated. Upon receipt of the HCBTACTIVATE, the 
HOOKS DLL module will post a WH_HCBT_ACTIVATE message to 

25 indicate the handle for logging by RITA of the window being activated. 
A handle is an integer, uniquely identifying an active process in Microsoft 
Windows. Upon interception of an HCBT_CREATEWND message 
indicating the handle of the newly created window from the Windows user 
module 22, the HOOKS DLL module 24 will post a 

30 WH_HCBT_CREATEWND to RITA for logging. Upon interception of an 
HCBT DESTROYWND message from the Windows user module 22 
indicating the handle of a window about to be destroyed, the HOOKS DLL 
module 24 will send a WH_HCBT_DESTROYWND message to the RITA 



WO 96/41495 



PCIYUS96/10091 



12 



main window 23 for logging. Upon interception of an 
HCBT_CBT_MINMAX message from the Windows user module indicating 
the handle of a window about to be niinimized or maximized, the HOOKS 
DLL module 24 will post a WH_HCBT_CBTMINMAX message to the 
5 RITA main window 23. The HCBT_CBTMINMAX message may take 
several forms, each being operation codes which will indicate if the 
window is being minimized, maximized, restored, etc. Depending on the 
operation code intercepted, the HOOKS DLL will post one of several 
messages to RITA for logging, including an SW HIDE, 

10 SW_SHOWMINIMIZED, SW_MINIMIZE, SW RESTORE^ 
SW MAXIMIZE, SW_NORMAL or SW_SHOW. 

Figure 4 illustrates the RITA main window 23 response to Windows 
application messages generated by the window user module. Block 27 
illustrates the RITA response to a WMCREATE message. A 

15 WM_CREATE message indicates that the application is starting. The 
response will be to prompt the panelist ID message (if this is the first time 
the application is run), to log a METER operation code entry, to log a 
PANEL operation code entry, to log a START operation code entry, and 
to log one or more RUNNG tasks entries. The prompt for panelist ID 

20 allows the panelist to uniquely identify him/herself with a predetermine 
seven digit number. Each event that is logged requires construction of a 
log entry as described below. Each entry will include an operation code 
indicative of the type of event being logged. RUNNG tasks entries are 
logged for any Windows application which is already running when the 

25 computer use meter is invoked through the main RITA module. Block 28 
indicates the RITA response to a WMJ5YSCOMMAND message. A 
WM_SYSCOMMAND message indicates that the user has activated the 
HTI icon from the Windows desktop. The response will be to change the 
user dialogue and to log a PANEL operation code entry. Changing the 

30 user dialogue affects the user name stored in subsequent logged records. 
Block 29 indicates the RITA response to a WM_QUERYENDSESSION 
message. A WM_QUERYENDSESSION message indicates that Windows 
is shutting down, but first passing control to RITA so that it may close 
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itself cleanly. The response will be to log a STOPM operation code entry 

and to flush, the log. Block 30 illustrates the RITA response to the 

WM_DESTROY message generated by the user module. A 

WMJDESTROY message indicates the user explicitly closed RITA. The 

5 response is to log a STOPM operation code entry and to flush the log. 

The log flush operation constitutes writing to the log file any records that 

are still held in memory. 

The log file may use a fixed column format to store data. The first 

column may contain a logging sequence number that may be used for post 

10 processor parsing. The log file may also include columns for a date stamp 

and a time stamp to be applied to each record. The next column may 

include an operation code as follows: 

RUNNG This designates the tasks that are already running 

PANEL Panelist name and identification are located in record 

15 data portion 

METER application log and version information 

START Starts the meter 

ACTVT Notes that a top level window task is activated 

TSTRT Notes that a top level widow task has started 

20 TSTOP Notes a top level window task has stopped 

MINIM Notes that a top level window has been minimized 

RESTO Notes that a top level window has either been 
restored from its iconic states or restored to its 
original state from a maximized state 

25 STOPM stops the meter 

INTRV Interview record data 

The following represents an example of log entries. 
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5 00001 
00002 
00003 



10 00006 
00007 
00009 

000010 
000011 



05/26/95 
05/25/95 
05/25/95 



10:40:27 
10:40:27 
10:4057 



METER 
PANEL 
START 



1234561 0000 
12345610000 
1234561 0000 



00004 05/25/95 10:40:27 RUNNG 1234561 2a96 



00005 05/25/95 10:40:27 RUNNG 1234561 201e 



05/25/95 
05/25/95 
05/25/95 

05/25/95 
05/25/95 



10:40:27 
10:4057 
10:4057 

10:4057 
10:4058 



RUNNG 
RUNNG 
RUNNG 

MIMIM 
ACTVT 



15 000014 05/25/95 10:4059 TSTRT 



1234561 lflSe 
12345610736 
1234561 87de 

1234561 37de 
1234561 164e 

1234561 357e 



000015 05/25/95 10:40:33 TSTRT 1234561 36d6 



000016 05/25/95 10:40:33 TSTRT 1234561 08ce 



000017 
000018 



05/25/95 
05/25/95 



10:40:34 
10:40:34 



TSTOP 
TSTRT 



1234561 S57e 
1234561 857e 



[D=02.00-02] 

[D=John Doe] 

ED=iniStartTask=l 
EndTask= 1 

Minimize=2 Maximizes 1 
Activates 1 

Restore= 1 Runnings: 1] 

[D=C:\DOS\MOUSE\POINTS 
R.EXS] 

[T=Pointer Options] [S= 10432] 

[D=C:\WINDOWS\NETDDE£ 
XS] 

[T=NetDDE] [S=§2432] 

P=C:\WINDOWS\SYSTEM\ 
DDEML.DLL] [S=39424] 

ID=C:\WINDOWS\SYSTEM\ 
USERJ3XE] [S =264096] 

OD=C:\HTI\HTI\JXE] 
[T=HTI] 

[S=55656] 

[D=C:\HTI\HTI.EXE] 

P=C:\APPWIN\DASH\DASH. 
EXE] 

P=C:\APPWIN\OMGUI\ 
OMGULEXE] [T=OpenMail 
user 

"pinsley* on server 'nyT] 
tS=443360] 

P=C:\WINDOWS/UALALLOC 
EXE] 

[S=3776] 

[D=C:\WINDOWS\SYSTEM\ 
HSASRV.EXE] [T=Windows 
Sockets 

Asynchronous Request Server] 
[8=6505] 

[D=C:\APPWIN\OMGUI\OMG 
ULEXE] 

[D=C:\APPWIN\OMGUI\OMG 
ULEXE] 
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000019 05/25/95 10:40:84 ACTVT 1234561 164e P=C:\APPWIN\DASH\DASH. 

EXE] 

000022 05/25/95 10:40:36 ACTVT 1234561 164e [D=C:\APPWIN\DASH\DASH. 

EXE] 

000024 05/25/95 10:40:36 TSTOP 1234561 lfBe [D= C:\WINDOWS\SYSTEM\ 

DDEMLDLL] 

000025 05/25/95 10:40:36 TSTOP 1234561 l£Be P=C:\WINDOWS\SYSTEM\ 

DDEMLDLL] 

5 000026 05/25/95 10:40:40 ACTVT 1234561 164e [D=C:\APPWIN\DASH\DASH. 

EXE] 

000027 05/25/95 10:40:40 TSTRT 1234561 2fe6 [D=C:\WINDOWS\CAIiC.EXE] 

[T=Calculator] [S=43072] 

000028 05/25/95 10:40:41 ACTVT 1234561 164e [D=C:\APPWIN\DASH\DASH. 

EXE] 

000029 05/25/95 10:40:43 ACTVT 1234561 I64e P=C:\APPWIN\DASH\DASH. 

EXE] 

000030 05/25/95 10:40:43 TSTRT 12345613016 [D=C:\WINDOWS\CAEDFILE. 

EXE] 

[TsCardfile - (Untitled)] 
[S=93184] 

10 000031 05/25/95 10:40:44 ACTVT 1234561 164e [D=C:\APPWIN\DASH\DASH. 

EXE] 

000032 05/25/95 10:40:46 ACTVT 1234561 164e [D=C:\APPWIN\DASH\DASH. 

EXE] 

000033 05/25/95 10:40:46 TSTRT 1234561 2bl6 [D=C:\WINDOWS\NOTEPAD. 

EXE] 

[T=Notepad - (Untitled)] 
[S= 32736] 

000034 05/25/95 10:40:46 ACTVT 1234561 2bl6 [D=C:\WINDOWS\NOTEPAD. 

EXE] 

000035 05/25/95 10:40:51 ACTVT 12345618016 [D=C:\WINDOWS\CARDFILE. 

EXE] 

15 000036 05/25/95 10:40:57 ACTVT 1234561 2fe6 [D=C:\WINDOWS/CALGJXE] 

000037 05/25/95 10:40:58 MINIM 1234561 3016 [D=C:\WINDOWS\CARDFILE. 

EXE] 

000038 05/25/95 10:40:58 ACTVT 12345618016 [D=C:\WINDOWS\CARDFILE. 

EXE] 

000039 05/25/95 10:41:00 ACTVT 1234561 2bl6 [D=C:\WINDOWS\NOTEPAD. 

EXE] 

000040 05/25/95 10:41:02 TSTOP 1234561 2bl6 ID=C:\WINDOWS\NOTEPAD. 

EXE] 
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000041 


05/25/95 


10:41:02 


ACTVT 


1234561 3016 


000042 


05/25/95 


10:41:04 


ACTVT 


1234561 2fe6 


000043 


05/25/95 


10:41:05 


RESTO 


1234561 2fe6 


000044 


05/25/95 


10:41:06 


TSTOP 


12345R1 


5 000045 


05/25/95 


10:41:06 


ACTVT 


1234561 3016 


000046 


05/25/95 


10:41:08 


TSTOP 


1234561 3016 


000047 


05/25/95 


10:41:08 


ACTVT 


1234561 164e 


000048 


05/25/95 


10:41:16 


ACTVT 


1234561 164e 


000049 


05/25/95 


10:41:19 


STOPM 


1234561 0000 



10 



15 



20 



25 



P=C:\WrNDOWS\CARDriLE. 
EXE] 

P=C:\WINDOWS/CALCJSE] 

P=C:\WINIX>WS/CALC.EXE] 

[D=C:\WINIX)WS/CALC£XE] 

[D= C:\WINDOWS\CARDFILE 
EXE] 

P=C:\WINDOWS\CARDFILE 
EXE] 

P=C:\APPWIN\DASH\DASH. 
EXE] 

P=C:\APPWIN\DASH\DASH. 
EXE] 

P= Windows Shutdown] 

As can be seen from the log entry table, each entry includes a 
sequence number, date stamp, time stamp, operation code or event type 
and data field. The information contained in the data field is dictated by* 
the event type. In the example shown, the next field contains the panelist 
or user identification, in this case "1234561" followed by a field containing 
the handle to the instance of the application, if any. Log record sequence 
number 00001 has a METER operation code entay which records the 
application, logo and version information in the data field. In the log entry 
having sequence number 00002, the PANEL operation code is presented to 
store the panelist's name and may store other identification information. 
In the example given, the name recorded is John Doe. Upon application 
start-up, a START operation code log entry is made which records 
configuration information in the data field. According to an advantageous 
embodiment, the computer use meter is automatically nmiimized after 
start-up. Other relevant information may be included in the data portion 
of log entries for various event types. The data field may include different 
information identified by label. In the example shown the label «S" 
identifies the file size of an application. The label T' identifies the 
Windows title of the application. The label D" identifies miscellaneous 
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data, typically the full path of the application. Other labels and 
information could also be logged. 

According to a further embodiment of the invention, the use meter 
may log additional events either in the same log file or in auxiliary logged 
files. The additional events may be logged based on a periodic audit. The 
periodic audit may be triggered by a timer. That timer is advantageously 
implemented in software and may run in its own window or on a systems 
level. Advantageously, an audit is triggered every one-half second, 
although other trigger periods may be selected. The use meter may 
periodically audit computer use for on-line program activity. The meter 
may be set to audit the computer for predetermined or preselected 
computer applications or applications which rely on predetermined 
resources such as modem access. The preselected computer applications 
may be known online service access and interface applications such as 
those provided by America Online, Compuserve, Prodigy or the Microsoft 
Network. If the audit reveals that one of the preselected applications is 
displayed or, alternatively, active, information from the application window 
and the top window may be logged. Advantageously, the logged 
information may be the textual content of the application's title bar and 
that of the top window of such an application. According to a preferred 
refinement, the system will only log the textual content of the title bars if 
the contents of the application or top window title bars are different from 
the previously logged title bars for the same application. 

Another embodiment of the periodic auditing feature includes 
periodically auditing preselected types of display elements. In the Windows 
operating system, each displayed window is made up of a number of display 
elements. The display elements include inter alia edit boxes and buttons. 
According to a preferred feature, the content of edit boxes may be 
examined. If the content is consistent with a predetermined criteria, the 
content will be logged. For example, it is assumed that, if the content of 
an edit box is consistent with the syntax for a URL, then the window 
corresponds to an internet browser program. Logging the content of the 
edit box will be indicative of the user's access of documents on the internet. 
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Figure 5 shows an audit based use meter. The audit based 
subsystem includes a timer 40. The timer 40 triggers the audit module 41. 
The audit module compares the content of an audit target 42 against 
predetermined criteria 43. If the predetermined criteria are satisfied, the 
audit module creates an entry in the event log 44. The target may be a 
display or other information indicative of computer use and activity. The 
criteria 43 maybe an identification of predetermined application programs, 
Windows, or a syntax such as, for example, a syntax consistent with a 
univeral resource locator for the Internet or, more particularly, for the 
Worldwide Web. 

It will be understood by those of ordinary skill in the art that the 
use meter, according to the invention, may be altered in various ways 
within the basic concept of the invention. 
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I claim: 

1 1. A computer use monitoring system comprising: 

2 a plurality of local computer use meters installed in user computer 

3 machines, each including a log of predetermined machine operation events 

4 stored in memory of said computer machines; 

5 a processing station installed in a computer machine which loads a 

6 log of predetermined machine operation events into computer memory; 

7 a database management system installed in a computer machine 

8 configured to access, process and generate reports based on the machine 

9 operation events stored in said computer memory; 

10 wherein said processing station is linked to said plurality of local 

11 computer use meters. 

1 2. A computer use monitoring system according to claim 1, 

2 wherein said processing station is linked to said plurality of local computer 

3 use meters by an electronic communication channel. 

1 3. A computer use monitoring system according to claim 2, 

2 wherein said electronic communication channel is established based upon 

3 a predetermined criteria. 

1 4. A computer use monitoring Bystem according to claim 3, 

2 wherein said predetermined criteria is periodic. 

1 5. A computer use monitoring system according to claim 3, 

2 wherein said predetermined criteria is based on the amount of memory 

3 occupied by said log. 

1 6. A computer use monitoring system according to claim 1, 

2 wherein said processing station is linked to said plurality of local computer 

3 use meters by means for transferring a log from a user computer machine 
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4 to a portable magnetic media and means for transferring said log from said 

5 portable magnetic media to processing station. 

1 7. A computer use monitoring system according to claim 1, 

2 wherein said predetermined machine operation events include events 

3 corresponding to operating system call back messages. 

1 8. A computer use monitoring system according to claim 1, 

2 wherein said predetermined machine operation events include events 

3 corresponding to an intercepted modem character string. 

1 9. A computer use monitoring system according to claim 1, 

2 further comprising a dictionary file stored in computer memory associated 

3 with said processing station; and 

4 means for interpreting the logged machine operation events by 

5 reference to the dictionary file. 

1 10. A computer use monitoring method comprising the steps of: 

2 eavesdropping on operating system messages and indicating receipt 

3 of predetermined types of messages responsive to an operating system 

4 messaging module; 

5 creating and storing an event log responsive to selected operating 

6 system messages; 

7 transferring one or more event logs from one or more computer 

8 systems to a central system; and 

9 analyzing the contents of said event logs. 

1 11. A method for determining the nature of computer use by a 

2 plurality of computer systems comprising the steps of: 

3 generating a lot of machine operation events in each of a plurality 

4 of user computer systems; 

5 storing each of the events in said log in the local computer memory 

6 of said user computer systems; 
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7 transferring said stored events from said plurality of user computer 

8 systems to a processing station computer; 

9 loading said event logs into memory associated with said processing 

10 station computer; 

11 interpreting said event logs by reference to a dictionary stored in 

12 memory associated with said processing station computer; and 

13 compiling and reporting said interpreted computer event logs 

14 according to specified criteria. 

1 12. A method for determining the nature of computer use by a 

2 plurality of computer systems according to claim 11, wherein said step of 

3 transferring is over an electronic communication channel. 

1 13. A A method for determining the nature of computer use by a 

2 plurality of computer systems according to claim 12, wherein said step of 

3 transferring is initiated based upon a predetermined criteria. 

1 14. A method for determining the nature of computer use by a 

2 plurality of computer systems according to claim 13, wherein said 

3 predetermined criteria is periodic. 

1 15. A method for determining the nature of computer use by a 

2 plurality of computer systems according to claim 13, wherein said 

3 predetermined criteria is based on the amount of memory occupied by said 

4 log. 

1 16. A method for deterniining the nature of computer use by a 

2 plurality of computer systems according to claim 11, wherein the step of 

3 transferring comprises transferring a log from a user computer machine to 

4 a portable magnetic media and transferring said log from said portable 

5 magnetic media to said processing station computer. 
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1 17. A method for determining the nature of computer use by a 

2 plurality of computer systems according to claim 11, wherein said machine 

3 operation events include predetermined events corresponding to operating 

4 system call back messages. 

1 18. A method for detennining the nature of computer use by a 

2 plurality of computer systems according to claim 11, wherein said machine 

3 operation events include events corresponding to an intercepted modem 

4 character string. 

1 19. A computer use monitoring method comprising the steps of: 

2 periodically auditing information displayed on a computer monitor 

3 and 

4 creating and storing a log of labels indicative of usage activity. 

1 20. A computer use monitoring method according to claim 19 

2 wherein said step of auditing polls information displayed by preselected 

3 computer application programs. 

1 21. A computer use monitoring method according to claim 20 

2 wherein said preselected computer application programs are on-line service 

3 access and interface programs and said step of creating and storing said log 

4 of labels logs active display element titles. 

1 22. A computer use monitoring method according to claim 19 

2 wherein said step of auditing monitors content of display elements and 

3 identifies display element content satisfying a predetermined criteria; and 

4 said step of creating and storing comprises logging the content of 
6 identified display elements. 

1 23. A computer use meter according to claim 22 wherein said 

2 display elements are edit boxes and said predetermined criteria is a 

3 predetermined syntax. 
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1 24. A computer use meter according to claim 23 wherein said syntax 

2 is a URL syntax. 

1 25. A computer use meter according to claim 23 further 

2 comprising the step of eavesdropping on operating system messages and 

3 indicating receipt of predetermined types of messages responsive to an 

4 operating system messaging module. 
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eyboard 
events 



windows application, 
messages 
WM CREATE 
WM SYSCOMMAND 
WM COMMAND 
WM QUE"RYENDSESSION 
"WM DESTROY 




mouse 
events 




windows CBT events 

HCBT ACTIVATE 
HCBT CREATEWND 
HCBT "DESTROYWND 
HCBT CBTMINMAX- 



windows user defined 
messages sem 
CBT_DESTROYWND 

windows user defin 
messages posted 
WH HCBT ACTIVATE 
WH HCBT CREATEWND 
WH~ HCBT" CBTMINMAX 
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HCBT_ ACTIVATE 
handles of the,, 
currently active 
window and 

rindow 
"about to be 
activated 



Windows 

User 
Module 



HCBT_dESTROYWNt 
handle of the 
window about to 
be destroyed 



HCBT_C RE ATEWND 
handle of the newly 
create window 



HOOKS 
DLL 



HCBT_CBTMINMAX 
handle of the window 
being minimized or 
maximized 

operation code 
indicating if the 
indow is being 
minimized, 
maximized, 
restored, etc. 



(Posted) 
WH HCBT_ACn\7ATE 
handle~ofthe 
window being 
activated 



Sent) 

WH_HCBTiDESTROYWND 
handle of the 
window being 

***** (Posted) 

WH_HCBT CBTMINMAX 
handle of the 

(Posted) / T*"" ^ 

WS.HCBT CREATEWND / changed 
handle fb the - # uinc 
windowbeing / sW_SHO«ffilNIMIZED 

MINIMIZE 
SWRESTORE 
SW~ MAXIMIZE 
SW~ NORMAL 
S\A7 SHOW 




3. 
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change user dialog 
log PANEL op code 

i3 



log STOPM op code 
flush log 
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